diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index 14e990e..640a8f3 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -7,7 +7,7 @@
 #include "packet_helper.h"
 #include "packet_filter.h"
 #include "snowflake.h"
-#include "session_def.h"
+#include "session_private.h"
 #include "session_utils.h"
 #include "session_pool.h"
 #include "session_table.h"
@@ -441,11 +441,11 @@ static enum flow_direction identify_direction_by_history(const struct session *s
 {
      if (tuple6_cmp(session_get_tuple6(sess), key) == 0)
      {
-          return session_get_tuple6_direction(sess);
+          return FLOW_DIRECTION_C2S;
      }
      else
      {
-          return (session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S);
+          return FLOW_DIRECTION_S2C;
      }
 }
 
@@ -537,13 +537,10 @@ static void session_update(struct session_manager *mgr, struct session *sess, en
      if (session_get_current_state(sess) == SESSION_STATE_INIT)
      {
           session_set_id(sess, snowflake_id_generate(mgr->now_ms / 1000));
-          session_set_tuple6(sess, key);
-          session_set_tuple_direction(sess, dir);
-
           enum packet_direction pkt_dir = packet_get_direction(pkt);
-
           if (dir == FLOW_DIRECTION_C2S)
           {
+               session_set_tuple6(sess, key);
                if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
                {
                     session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
@@ -552,9 +549,13 @@ static void session_update(struct session_manager *mgr, struct session *sess, en
                {
                     session_set_direction(sess, SESSION_DIRECTION_INBOUND);
                }
+               tuple6_to_str(key, sess->tuple_str, sizeof(sess->tuple_str));
           }
           else
           {
+               struct tuple6 out;
+               tuple6_reverse(key, &out);
+               session_set_tuple6(sess, &out);
                if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
                {
                     session_set_direction(sess, SESSION_DIRECTION_INBOUND);
@@ -563,9 +564,9 @@ static void session_update(struct session_manager *mgr, struct session *sess, en
                {
                     session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
                }
+               tuple6_to_str(&out, sess->tuple_str, sizeof(sess->tuple_str));
           }
 
-          tuple6_to_str(key, sess->tuple_str, sizeof(sess->tuple_str));
           session_set_timestamp(sess, SESSION_TIMESTAMP_START, mgr->now_ms);
           switch (key->ip_proto)
           {
@@ -1226,3 +1227,115 @@ void session_set_discard(struct session *sess)
           break;
      }
 }
+
+static inline uint8_t ipv4_in_range(const struct in_addr *addr, const struct in_addr *start, const struct in_addr *end)
+{
+     return (memcmp(addr, start, sizeof(struct in_addr)) >= 0 && memcmp(addr, end, sizeof(struct in_addr)) <= 0);
+}
+
+static inline uint8_t ipv6_in_range(const struct in6_addr *addr, const struct in6_addr *start, const struct in6_addr *end)
+{
+     return (memcmp(addr, start, sizeof(struct in6_addr)) >= 0 && memcmp(addr, end, sizeof(struct in6_addr)) <= 0);
+}
+
+uint64_t session_manager_scan(const struct session_manager *mgr, const struct session_scan_opts *opts, uint64_t mached_sess_ids[], uint64_t array_size)
+{
+     uint64_t capacity = 0;
+     uint64_t max_loop = 0;
+     uint64_t mached_sess_num = 0;
+     const struct session *sess = NULL;
+     const struct tuple6 *tuple = NULL;
+
+     if (mgr == NULL || opts == NULL || mached_sess_ids == NULL || array_size == 0)
+     {
+          return mached_sess_num;
+     }
+     if (opts->count == 0)
+     {
+          return mached_sess_num;
+     }
+     capacity = session_pool_capacity_size(mgr->sess_pool);
+     if (opts->cursor >= capacity)
+     {
+          return mached_sess_num;
+     }
+
+     max_loop = MIN(capacity, opts->cursor + opts->count);
+     for (uint64_t i = opts->cursor; i < max_loop; i++)
+     {
+          sess = session_pool_get0(mgr->sess_pool, i);
+          tuple = session_get_tuple6(sess);
+          if (session_get_current_state(sess) == SESSION_STATE_INIT)
+          {
+               continue;
+          }
+
+          if ((opts->flags & SESSION_SCAN_TYPE) && opts->type != session_get_type(sess))
+          {
+               continue;
+          }
+          if ((opts->flags & SESSION_SCAN_STATE) && opts->state != session_get_current_state(sess))
+          {
+               continue;
+          }
+          if ((opts->flags & SESSION_SCAN_CREATE_TIME) &&
+              (session_get_timestamp(sess, SESSION_TIMESTAMP_START) < opts->create_time_ms[0] ||
+               session_get_timestamp(sess, SESSION_TIMESTAMP_START) > opts->create_time_ms[1]))
+          {
+               continue;
+          }
+          if ((opts->flags & SESSION_SCAN_LAST_PKT_TIME) &&
+              (session_get_timestamp(sess, SESSION_TIMESTAMP_LAST) < opts->last_pkt_time_ms[0] ||
+               session_get_timestamp(sess, SESSION_TIMESTAMP_LAST) > opts->last_pkt_time_ms[1]))
+          {
+               continue;
+          }
+          if ((opts->flags & SESSION_SCAN_SPORT) && opts->src_port != tuple->src_port)
+          {
+               continue;
+          }
+          if ((opts->flags & SESSION_SCAN_DPORT) && opts->dst_port != tuple->dst_port)
+          {
+               continue;
+          }
+          if (opts->flags & SESSION_SCAN_SIP)
+          {
+               if (opts->addr_family != tuple->addr_family)
+               {
+                    continue;
+               }
+               if ((opts->addr_family == AF_INET) && !ipv4_in_range(&tuple->src_addr.v4, &opts->src_addr[0].v4, &opts->src_addr[1].v4))
+               {
+                    continue;
+               }
+               if ((opts->addr_family == AF_INET6) && !ipv6_in_range(&tuple->src_addr.v6, &opts->src_addr[0].v6, &opts->src_addr[1].v6))
+               {
+                    continue;
+               }
+          }
+          if (opts->flags & SESSION_SCAN_DIP)
+          {
+               if (opts->addr_family != tuple->addr_family)
+               {
+                    continue;
+               }
+               if ((opts->addr_family == AF_INET) && !ipv4_in_range(&tuple->dst_addr.v4, &opts->dst_addr[0].v4, &opts->dst_addr[1].v4))
+               {
+                    continue;
+               }
+               if ((opts->addr_family == AF_INET6) && !ipv6_in_range(&tuple->dst_addr.v6, &opts->dst_addr[0].v6, &opts->dst_addr[1].v6))
+               {
+                    continue;
+               }
+          }
+
+          mached_sess_ids[mached_sess_num++] = session_get_id(sess);
+          if (mached_sess_num >= array_size)
+          {
+               break;
+          }
+     }
+
+     SESSION_LOG_DEBUG("session scan: cursor=%lu, count=%lu, mached_sess_num=%lu", opts->cursor, opts->count, mached_sess_num);
+     return mached_sess_num;
+}
diff --git a/src/session/session_manager.h b/src/session/session_manager.h
index 6d3745a..580dda3 100644
--- a/src/session/session_manager.h
+++ b/src/session/session_manager.h
@@ -5,6 +5,9 @@ extern "C"
 {
 #endif
 
+#include "tuple.h"
+#include "session_private.h"
+
 struct session_manager_options
 {
     // max session number
@@ -89,6 +92,42 @@ struct session_manager_stat
     uint64_t tcp_segs_freed;            // sum
 };
 
+enum session_scan_flags
+{
+    SESSION_SCAN_TYPE = 1 << 0,
+    SESSION_SCAN_STATE = 1 << 1,
+
+    SESSION_SCAN_SIP = 1 << 2,
+    SESSION_SCAN_DIP = 1 << 3,
+
+    SESSION_SCAN_SPORT = 1 << 4,
+    SESSION_SCAN_DPORT = 1 << 5,
+
+    SESSION_SCAN_CREATE_TIME = 1 << 6,
+    SESSION_SCAN_LAST_PKT_TIME = 1 << 7,
+};
+
+struct session_scan_opts
+{
+    // required
+    uint32_t flags;
+    uint32_t cursor;
+    uint32_t count;
+
+    // optional
+    enum session_type type;
+    enum session_state state;
+
+    uint32_t addr_family;         // AF_INET or AF_INET6
+    union ip_address src_addr[2]; // network byte order
+    union ip_address dst_addr[2]; // network byte order
+    uint16_t src_port;            // network byte order
+    uint16_t dst_port;            // network byte order
+
+    uint64_t create_time_ms[2];
+    uint64_t last_pkt_time_ms[2];
+};
+
 struct session_manager;
 struct session_manager *session_manager_new(struct session_manager_options *opts, uint64_t now_ms);
 void session_manager_free(struct session_manager *mgr);
@@ -110,6 +149,7 @@ struct session *session_manager_get_evicted_session(struct session_manager *mgr)
 uint64_t session_manager_get_expire_interval(struct session_manager *mgr);
 
 struct session_manager_stat *session_manager_stat(struct session_manager *mgr);
+uint64_t session_manager_scan(const struct session_manager *mgr, const struct session_scan_opts *opts, uint64_t mached_sess_ids[], uint64_t array_size);
 
 #ifdef __cplusplus
 }
diff --git a/src/session/session_pool.cpp b/src/session/session_pool.cpp
index 798a8a1..11b6d57 100644
--- a/src/session/session_pool.cpp
+++ b/src/session/session_pool.cpp
@@ -1,6 +1,6 @@
 #include <stdlib.h>
 
-#include "session_def.h"
+#include "session_private.h"
 #include "session_pool.h"
 
 struct session_pool
diff --git a/src/session/session_def.h b/src/session/session_private.h
similarity index 100%
rename from src/session/session_def.h
rename to src/session/session_private.h
diff --git a/src/session/session_table.cpp b/src/session/session_table.cpp
index 651ef60..b1e55a1 100644
--- a/src/session/session_table.cpp
+++ b/src/session/session_table.cpp
@@ -3,7 +3,7 @@
 #define HASH_INITIAL_NUM_BUCKETS 32768U // initial number of buckets
 #define HASH_FUNCTION(keyptr, keylen, hashv) HASH_FUNCTION_OVERWRITE(keyptr, keylen, &hashv)
 #define HASH_KEYCMP(a, b, len) HASH_KEYCMP_OVERWRITE(a, b, len)
-#include "session_def.h"
+#include "session_private.h"
 #include "session_table.h"
 
 struct session_table
diff --git a/src/session/session_timer.cpp b/src/session/session_timer.cpp
index c3ff593..83abe6a 100644
--- a/src/session/session_timer.cpp
+++ b/src/session/session_timer.cpp
@@ -1,4 +1,4 @@
-#include "session_def.h"
+#include "session_private.h"
 #include "session_timer.h"
 
 struct session_timer
diff --git a/src/session/session_utils.cpp b/src/session/session_utils.cpp
index 5eda436..13ab7e0 100644
--- a/src/session/session_utils.cpp
+++ b/src/session/session_utils.cpp
@@ -1,6 +1,6 @@
 #include <assert.h>
 
-#include "session_def.h"
+#include "session_private.h"
 #include "session_utils.h"
 #include "session_manager.h"
 
@@ -50,16 +50,6 @@ const struct tuple6 *session_get_tuple6(const struct session *sess)
     return &sess->tuple;
 }
 
-void session_set_tuple_direction(struct session *sess, enum flow_direction dir)
-{
-    sess->tuple_dir = dir;
-}
-
-enum flow_direction session_get_tuple6_direction(const struct session *sess)
-{
-    return sess->tuple_dir;
-}
-
 const char *session_get0_readable_addr(const struct session *sess)
 {
     return sess->tuple_str;
diff --git a/src/session/session_utils.h b/src/session/session_utils.h
index d566a48..872a72e 100644
--- a/src/session/session_utils.h
+++ b/src/session/session_utils.h
@@ -25,8 +25,6 @@ void session_set_tuple6(struct session *sess, const struct tuple6 *tuple);
 const struct tuple6 *session_get_tuple6(const struct session *sess);
 
 // session tuple direction
-void session_set_tuple_direction(struct session *sess, enum flow_direction dir);
-enum flow_direction session_get_tuple6_direction(const struct session *sess);
 const char *session_get0_readable_addr(const struct session *sess);
 
 // session direction
diff --git a/src/session/test/CMakeLists.txt b/src/session/test/CMakeLists.txt
index 76bfdeb..0eb942b 100644
--- a/src/session/test/CMakeLists.txt
+++ b/src/session/test/CMakeLists.txt
@@ -97,6 +97,13 @@ target_link_libraries(gtest_session_transition session_manager gtest)
 add_executable(gtest_sess_mgr_tcp_reassembly gtest_sess_mgr_tcp_reassembly.cpp)
 target_link_libraries(gtest_sess_mgr_tcp_reassembly session_manager gtest)
 
+###############################################################################
+# gtest sess mgr scan
+###############################################################################
+
+add_executable(gtest_sess_mgr_scan gtest_sess_mgr_scan.cpp)
+target_link_libraries(gtest_sess_mgr_scan session_manager gtest)
+
 ###############################################################################
 # gtest case
 ###############################################################################
@@ -137,5 +144,6 @@ gtest_discover_tests(gtest_overload_evict_udp_sess)
 gtest_discover_tests(gtest_session_transition)
 
 gtest_discover_tests(gtest_sess_mgr_tcp_reassembly)
+gtest_discover_tests(gtest_sess_mgr_scan)
 
 gtest_discover_tests(gtest_case_tcp_fast_open)
\ No newline at end of file
diff --git a/src/session/test/gtest_case_tcp_fast_open.cpp b/src/session/test/gtest_case_tcp_fast_open.cpp
index 5483da8..d1c0f89 100644
--- a/src/session/test/gtest_case_tcp_fast_open.cpp
+++ b/src/session/test/gtest_case_tcp_fast_open.cpp
@@ -326,7 +326,6 @@ TEST(CASE, TCP_FAST_OPEN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "2400:ac40:620:a4d8:484f:d2b0:d539:bd4c:51682-2001:4860:4860::8844:853-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_sess_mgr_scan.cpp b/src/session/test/gtest_sess_mgr_scan.cpp
new file mode 100644
index 0000000..2b7aae0
--- /dev/null
+++ b/src/session/test/gtest_sess_mgr_scan.cpp
@@ -0,0 +1,398 @@
+#include <gtest/gtest.h>
+
+#include "snowflake.h"
+#include "session_utils.h"
+#include "session_manager.h"
+#include "packet_private.h"
+#include "packet_parser.h"
+#include "test_packets.h"
+
+struct session_manager_options opts = {
+    // max session number
+    .max_tcp_session_num = 256,
+    .max_udp_session_num = 256,
+
+    // session overload
+    .tcp_overload_evict_old_sess = 1, // 1: evict old session, 0: bypass new session
+    .udp_overload_evict_old_sess = 1, // 1: evict old session, 0: bypass new session
+
+    // tcp timeout
+    .tcp_init_timeout = 1,
+    .tcp_handshake_timeout = 2,
+    .tcp_data_timeout = 3,
+    .tcp_half_closed_timeout = 4,
+    .tcp_time_wait_timeout = 5,
+    .tcp_discard_timeout = 6,
+    .tcp_unverified_rst_timeout = 7,
+
+    // udp timeout
+    .udp_data_timeout = 8,
+    .udp_discard_timeout = 0,
+
+    // duplicate packet filter
+    .duplicated_packet_filter_enable = 1,
+    .duplicated_packet_filter_capacity = 1000,
+    .duplicated_packet_filter_timeout = 10,
+    .duplicated_packet_filter_error_rate = 0.0001,
+
+    // evicted session filter
+    .evicted_session_filter_enable = 1,
+    .evicted_session_filter_capacity = 1000,
+    .evicted_session_filter_timeout = 10,
+    .evicted_session_filter_error_rate = 0.0001,
+
+    // TCP Reassembly
+    .tcp_reassembly_enable = 1,
+    .tcp_reassembly_max_timeout = 60000,
+    .tcp_reassembly_max_segments = 16,
+};
+
+static inline void packet_overwrite_src_addr(struct packet *pkt, struct in_addr addr)
+{
+    const struct raw_layer *ipv4_layer = packet_get_innermost_raw_layer(pkt, LAYER_PROTO_IPV4);
+    struct ip *hdr = (struct ip *)ipv4_layer->hdr_ptr;
+    hdr->ip_src = addr;
+}
+
+static inline void mached_session_print(const char *title, struct session_manager *mgr, uint64_t mached_sess_ids[], uint64_t mached_sess_num)
+{
+    struct session *sess = NULL;
+    printf("%-*s mached_sess_num: %lu\n", 40, title, mached_sess_num);
+    for (uint64_t i = 0; i < mached_sess_num; i++)
+    {
+        sess = session_manager_lookup_session_by_id(mgr, mached_sess_ids[i]);
+        printf("session id: %lu, addr: %s, type: %s, state: %s, start: %lu, last: %lu\n",
+               mached_sess_ids[i], session_get0_readable_addr(sess),
+               session_type_to_str(session_get_type(sess)),
+               session_state_to_str(session_get_current_state(sess)),
+               session_get_timestamp(sess, SESSION_TIMESTAMP_START),
+               session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
+    }
+}
+
+#if 1
+TEST(SESS_MGR_SCAN, OPTS)
+{
+    char buff[1500] = {0};
+    uint64_t mached_sess_num = 0;
+    uint64_t mached_sess_ids[1460];
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    struct in_addr v4_src_addr1 = {};
+    struct in_addr v4_src_addr2 = {};
+    struct in_addr v4_src_addr3 = {};
+    struct in_addr v4_dst_addr = {};
+    struct in_addr v4_min_addr = {};
+    struct in_addr v4_max_addr = {};
+    struct in_addr v4_src_subnet_beg = {};
+    struct in_addr v4_src_subnet_end = {};
+    struct in_addr v4_dst_subnet_beg = {};
+    struct in_addr v4_dst_subnet_end = {};
+
+    v4_src_addr1.s_addr = inet_addr("192.168.1.1");
+    v4_src_addr2.s_addr = inet_addr("192.168.1.2");
+    v4_src_addr3.s_addr = inet_addr("192.168.1.3");
+    v4_dst_addr.s_addr = inet_addr("93.184.216.34");
+
+    v4_min_addr.s_addr = inet_addr("0.0.0.0");
+    v4_max_addr.s_addr = inet_addr("255.255.255.255");
+
+    v4_src_subnet_beg.s_addr = inet_addr("192.168.1.0");
+    v4_src_subnet_end.s_addr = inet_addr("192.168.1.255");
+
+    v4_dst_subnet_beg.s_addr = inet_addr("93.184.216.0");
+    v4_dst_subnet_end.s_addr = inet_addr("93.184.216.255");
+
+    struct in6_addr v6_src_addr = {};
+    struct in6_addr v6_dst_addr = {};
+    struct in6_addr v6_min_addr = {};
+    struct in6_addr v6_max_addr = {};
+    struct in6_addr v6_src_subnet_beg = {};
+    struct in6_addr v6_src_subnet_end = {};
+    struct in6_addr v6_dst_subnet_beg = {};
+    struct in6_addr v6_dst_subnet_end = {};
+
+    inet_pton(AF_INET6, "dead::beef", &v6_src_addr);
+    inet_pton(AF_INET6, "cafe::babe", &v6_dst_addr);
+
+    inet_pton(AF_INET6, "0000:0000:0000:0000:0000:0000:0000:0000", &v6_min_addr);
+    inet_pton(AF_INET6, "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &v6_max_addr);
+
+    inet_pton(AF_INET6, "dead::0000", &v6_src_subnet_beg);
+    inet_pton(AF_INET6, "dead::ffff", &v6_src_subnet_end);
+
+    inet_pton(AF_INET6, "cafe::0000", &v6_dst_subnet_beg);
+    inet_pton(AF_INET6, "cafe::ffff", &v6_dst_subnet_end);
+
+    mgr = session_manager_new(&opts, 1);
+    EXPECT_TRUE(mgr != NULL);
+
+    // new session
+    memset(&pkt, 0, sizeof(pkt));
+    memcpy(buff, tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    packet_parse(&pkt, (const char *)buff, sizeof(tcp_pkt1_c2s_syn));
+    packet_overwrite_src_addr(&pkt, v4_src_addr1);
+    EXPECT_TRUE(session_manager_lookup_session_by_packet(mgr, &pkt) == NULL);
+    sess = session_manager_new_session(mgr, &pkt, 1);
+    EXPECT_TRUE(sess);
+
+    // new session
+    memset(&pkt, 0, sizeof(pkt));
+    memcpy(buff, tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    packet_parse(&pkt, (const char *)buff, sizeof(tcp_pkt1_c2s_syn));
+    packet_overwrite_src_addr(&pkt, v4_src_addr2);
+    EXPECT_TRUE(session_manager_lookup_session_by_packet(mgr, &pkt) == NULL);
+    sess = session_manager_new_session(mgr, &pkt, 2);
+    EXPECT_TRUE(sess);
+
+    // new session
+    memset(&pkt, 0, sizeof(pkt));
+    memcpy(buff, tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    packet_parse(&pkt, (const char *)buff, sizeof(tcp_pkt1_c2s_syn));
+    packet_overwrite_src_addr(&pkt, v4_src_addr3);
+    EXPECT_TRUE(session_manager_lookup_session_by_packet(mgr, &pkt) == NULL);
+    sess = session_manager_new_session(mgr, &pkt, 3);
+    EXPECT_TRUE(sess);
+
+    // new session
+    memset(&pkt, 0, sizeof(pkt));
+    packet_parse(&pkt, (const char *)ipv6_in_ipv6_udp, sizeof(ipv6_in_ipv6_udp));
+    EXPECT_TRUE(session_manager_lookup_session_by_packet(mgr, &pkt) == NULL);
+    sess = session_manager_new_session(mgr, &pkt, 4);
+    EXPECT_TRUE(sess);
+
+    struct session_scan_opts scan = {};
+    // scan.flags = SESSION_SCAN_TYPE | SESSION_SCAN_STATE | SESSION_SCAN_SIP | SESSION_SCAN_DIP | SESSION_SCAN_SPORT | SESSION_SCAN_DPORT | SESSION_SCAN_CREATE_TIME | SESSION_SCAN_LAST_PKT_TIME;
+    scan.cursor = 0;
+    scan.count = 1460;
+
+    scan.last_pkt_time_ms[0] = 0;
+    scan.last_pkt_time_ms[1] = UINT64_MAX;
+
+    // SESSION_SCAN_TYPE
+    scan.flags = SESSION_SCAN_TYPE;
+
+    scan.type = SESSION_TYPE_TCP;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_TYPE: (TCP)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.type = SESSION_TYPE_UDP;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_TYPE: (UDP)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_STATE
+    scan.flags = SESSION_SCAN_STATE;
+
+    scan.state = SESSION_STATE_OPENING;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 4);
+    mached_session_print("SESSION_SCAN_STATE: (OPENING)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.state = SESSION_STATE_ACTIVE;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_STATE: (ACTIVE)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.state = SESSION_STATE_CLOSING;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_STATE: (CLOSING)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.state = SESSION_STATE_DISCARD;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_STATE: (DISCARD)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.state = SESSION_STATE_CLOSED;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_STATE: (CLOSED)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_SIP
+    scan.flags = SESSION_SCAN_SIP;
+
+    scan.addr_family = AF_INET;
+    scan.src_addr[0].v4 = v4_src_addr1;
+    scan.src_addr[1].v4 = v4_src_addr1;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_SIP: (IPv4)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET;
+    scan.src_addr[0].v4 = v4_src_subnet_beg;
+    scan.src_addr[1].v4 = v4_src_subnet_end;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_SIP: (IPv4 SUBNET)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET;
+    scan.src_addr[0].v4 = v4_min_addr;
+    scan.src_addr[1].v4 = v4_max_addr;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_SIP: (IPv4 MIN MAX)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.src_addr[0].v6, &v6_src_addr, sizeof(v6_src_addr));
+    memcpy(&scan.src_addr[1].v6, &v6_src_addr, sizeof(v6_src_addr));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_SIP: (IPv6)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.src_addr[0].v6, &v6_src_subnet_beg, sizeof(v6_src_subnet_beg));
+    memcpy(&scan.src_addr[1].v6, &v6_src_subnet_end, sizeof(v6_src_subnet_end));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_SIP: (IPv6 SUBNET)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.src_addr[0].v6, &v6_min_addr, sizeof(v6_min_addr));
+    memcpy(&scan.src_addr[1].v6, &v6_max_addr, sizeof(v6_max_addr));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_SIP: (IPv6 MIN MAX)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_DIP
+    scan.flags = SESSION_SCAN_DIP;
+
+    scan.addr_family = AF_INET;
+    scan.dst_addr[0].v4 = v4_dst_addr;
+    scan.dst_addr[1].v4 = v4_dst_addr;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_DIP: (IPv4)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET;
+    scan.dst_addr[0].v4 = v4_dst_subnet_beg;
+    scan.dst_addr[1].v4 = v4_dst_subnet_end;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_DIP: (IPv4 SUBNET)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET;
+    scan.dst_addr[0].v4 = v4_min_addr;
+    scan.dst_addr[1].v4 = v4_max_addr;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_DIP: (IPv4 MIN MAX)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.dst_addr[0].v6, &v6_dst_addr, sizeof(v6_dst_addr));
+    memcpy(&scan.dst_addr[1].v6, &v6_dst_addr, sizeof(v6_dst_addr));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_DIP: (IPv6)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.dst_addr[0].v6, &v6_dst_subnet_beg, sizeof(v6_dst_subnet_beg));
+    memcpy(&scan.dst_addr[1].v6, &v6_dst_subnet_end, sizeof(v6_dst_subnet_end));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_DIP: (IPv6 SUBNET)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.addr_family = AF_INET6;
+    memcpy(&scan.dst_addr[0].v6, &v6_min_addr, sizeof(v6_min_addr));
+    memcpy(&scan.dst_addr[1].v6, &v6_max_addr, sizeof(v6_max_addr));
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 1);
+    mached_session_print("SESSION_SCAN_DIP: (IPv6 MIN MAX)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_SPORT
+    scan.flags = SESSION_SCAN_SPORT;
+
+    scan.src_port = htons(60111);
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_SPORT: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.src_port = htons(60110);
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_SPORT: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_DPORT
+    scan.flags = SESSION_SCAN_DPORT;
+
+    scan.dst_port = htons(80);
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 3);
+    mached_session_print("SESSION_SCAN_DPORT: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.dst_port = htons(81);
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_DPORT: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_CREATE_TIME
+    scan.flags = SESSION_SCAN_CREATE_TIME;
+
+    scan.create_time_ms[0] = 0;
+    scan.create_time_ms[1] = UINT64_MAX;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 4);
+    mached_session_print("SESSION_SCAN_CREATE_TIME: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.create_time_ms[0] = 1;
+    scan.create_time_ms[1] = 2;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 2);
+    mached_session_print("SESSION_SCAN_CREATE_TIME: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.create_time_ms[0] = 0;
+    scan.create_time_ms[1] = 0;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_CREATE_TIME: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.create_time_ms[0] = UINT64_MAX;
+    scan.create_time_ms[1] = UINT64_MAX;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_CREATE_TIME: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    // SESSION_SCAN_LAST_PKT_TIME
+    scan.flags = SESSION_SCAN_LAST_PKT_TIME;
+
+    scan.last_pkt_time_ms[0] = 0;
+    scan.last_pkt_time_ms[1] = UINT64_MAX;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 4);
+    mached_session_print("SESSION_SCAN_LAST_PKT_TIME: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.last_pkt_time_ms[0] = 1;
+    scan.last_pkt_time_ms[1] = 2;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 2);
+    mached_session_print("SESSION_SCAN_LAST_PKT_TIME: (HIT)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.last_pkt_time_ms[0] = 0;
+    scan.last_pkt_time_ms[1] = 0;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_LAST_PKT_TIME: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    scan.last_pkt_time_ms[0] = UINT64_MAX;
+    scan.last_pkt_time_ms[1] = UINT64_MAX;
+    mached_sess_num = session_manager_scan(mgr, &scan, mached_sess_ids, sizeof(mached_sess_ids) / sizeof(mached_sess_ids[0]));
+    EXPECT_TRUE(mached_sess_num == 0);
+    mached_session_print("SESSION_SCAN_LAST_PKT_TIME: (MISS)", mgr, mached_sess_ids, mached_sess_num);
+
+    session_manager_free(mgr);
+}
+#endif
+
+int main(int argc, char **argv)
+{
+    struct snowflake_options opt = {
+        .snowflake_base = 1,
+        .snowflake_offset = 2,
+    };
+    snowflake_id_init(&opt);
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
\ No newline at end of file
diff --git a/src/session/test/gtest_session.cpp b/src/session/test/gtest_session.cpp
index 3afaf01..e58bd72 100644
--- a/src/session/test/gtest_session.cpp
+++ b/src/session/test/gtest_session.cpp
@@ -1,6 +1,6 @@
 #include <gtest/gtest.h>
 
-#include "session_def.h"
+#include "session_private.h"
 #include "session_utils.h"
 
 #pragma GCC diagnostic ignored "-Wunused-parameter"
diff --git a/src/session/test/gtest_session_timer.cpp b/src/session/test/gtest_session_timer.cpp
index 6a5e757..7c5ff26 100644
--- a/src/session/test/gtest_session_timer.cpp
+++ b/src/session/test/gtest_session_timer.cpp
@@ -1,6 +1,6 @@
 #include <gtest/gtest.h>
 
-#include "session_def.h"
+#include "session_private.h"
 #include "session_utils.h"
 #include "session_timer.h"
 
diff --git a/src/session/test/gtest_state_tcp_active_to_closing.cpp b/src/session/test/gtest_state_tcp_active_to_closing.cpp
index 55563d1..49747c1 100644
--- a/src/session/test/gtest_state_tcp_active_to_closing.cpp
+++ b/src/session/test/gtest_state_tcp_active_to_closing.cpp
@@ -125,7 +125,6 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_FIN_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -212,7 +211,6 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -299,7 +297,6 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -426,7 +423,6 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_HALF_CLOSED_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -506,7 +502,6 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_HALF_CLOSED_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_tcp_init_to_opening.cpp b/src/session/test/gtest_state_tcp_init_to_opening.cpp
index a8ba928..8fe3fbe 100644
--- a/src/session/test/gtest_state_tcp_init_to_opening.cpp
+++ b/src/session/test/gtest_state_tcp_init_to_opening.cpp
@@ -81,7 +81,6 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -158,8 +157,7 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK)
 
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "93.184.216.34:80-192.168.38.105:60111-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -249,7 +247,6 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -351,7 +348,6 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK_ACK)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -448,7 +444,6 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_RETRANSMISSION)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -545,8 +540,7 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK_RETRANSMISSION)
 
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "93.184.216.34:80-192.168.38.105:60111-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -636,7 +630,6 @@ TEST(TCP_INIT_TO_OPENING, BY_C2S_ASMMETRIC)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -725,8 +718,7 @@ TEST(TCP_INIT_TO_OPENING, BY_S2C_ASMMETRIC)
 
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "93.184.216.34:80-192.168.38.105:60111-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp b/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
index 05b0240..1c16735 100644
--- a/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
+++ b/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
@@ -77,7 +77,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -109,7 +108,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -141,7 +139,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -173,7 +170,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -205,7 +201,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -237,7 +232,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -269,7 +263,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -301,7 +294,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -333,7 +325,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -365,7 +356,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -397,7 +387,6 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_tcp_opening_to_active.cpp b/src/session/test/gtest_state_tcp_opening_to_active.cpp
index d8a6cbb..794a74b 100644
--- a/src/session/test/gtest_state_tcp_opening_to_active.cpp
+++ b/src/session/test/gtest_state_tcp_opening_to_active.cpp
@@ -92,7 +92,6 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYN_C2S_DATA)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -181,8 +180,7 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYNACK_S2C_DATA)
 
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "93.184.216.34:80-192.168.38.105:60111-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_tcp_opening_to_closing.cpp b/src/session/test/gtest_state_tcp_opening_to_closing.cpp
index 6926aa5..f1041d0 100644
--- a/src/session/test/gtest_state_tcp_opening_to_closing.cpp
+++ b/src/session/test/gtest_state_tcp_opening_to_closing.cpp
@@ -105,7 +105,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_FIN_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -201,7 +200,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -297,7 +295,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -443,7 +440,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_HANDSHAKE_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -545,7 +541,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_DATA_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -635,7 +630,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_HALF_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -724,7 +718,6 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_HALF_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111-93.184.216.34:80-6-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp b/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
index f4168cc..325d548 100644
--- a/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
+++ b/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
@@ -76,7 +76,6 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099-121.14.154.93:53-17-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -107,7 +106,6 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099-121.14.154.93:53-17-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp b/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
index df03bf0..14dc8c4 100644
--- a/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
+++ b/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
@@ -81,7 +81,6 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_C2S)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099-121.14.154.93:53-17-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
@@ -159,8 +158,7 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_S2C)
 
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "121.14.154.93:53-192.168.38.105:61099-17-0");
-    EXPECT_TRUE(session_get_tuple6_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_STREQ(buffer, "192.168.38.105:61099-121.14.154.93:53-17-0");
     EXPECT_TRUE(session_get_current_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_duplicate_traffic(sess) == 0);
diff --git a/src/session/test/test_packets.h b/src/session/test/test_packets.h
index e2f0225..231ef88 100644
--- a/src/session/test/test_packets.h
+++ b/src/session/test/test_packets.h
@@ -2697,6 +2697,54 @@ unsigned char tcp_out_of_order_pkt7[] = {
     0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
     0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x0a};
 
+/******************************************************************************
+ * [Protocols in frame: eth:ethertype:ipv6:ipv6:udp:data]
+ ******************************************************************************
+ *
+ * Frame 1: 106 bytes on wire (848 bits), 106 bytes captured (848 bits)
+ * Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
+ *     Destination: Broadcast (ff:ff:ff:ff:ff:ff)
+ *     Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
+ *     Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2001:4f8:4:7:2e0:81ff:fe52:ffff, Dst: 2001:4f8:4:7:2e0:81ff:fe52:9a6b
+ *     0110 .... = Version: 6
+ *     .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ *     .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ *     Payload Length: 52
+ *     Next Header: IPv6 (41)
+ *     Hop Limit: 64
+ *     Source Address: 2001:4f8:4:7:2e0:81ff:fe52:ffff
+ *     Destination Address: 2001:4f8:4:7:2e0:81ff:fe52:9a6b
+ *     [Source SLAAC MAC: TyanComp_52:ff:ff (00:e0:81:52:ff:ff)]
+ *     [Destination SLAAC MAC: TyanComp_52:9a:6b (00:e0:81:52:9a:6b)]
+ * Internet Protocol Version 6, Src: dead::beef, Dst: cafe::babe
+ *     0110 .... = Version: 6
+ *     .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ *     .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ *     Payload Length: 12
+ *     Next Header: UDP (17)
+ *     Hop Limit: 64
+ *     Source Address: dead::beef
+ *     Destination Address: cafe::babe
+ * User Datagram Protocol, Src Port: 30000, Dst Port: 13000
+ *     Source Port: 30000
+ *     Destination Port: 13000
+ *     Length: 12
+ *     Checksum: 0x83d2 [unverified]
+ *     [Checksum Status: Unverified]
+ *     [Stream index: 0]
+ *     [Timestamps]
+ *     UDP payload (4 bytes)
+ * Data (4 bytes)
+ */
+
+unsigned char ipv6_in_ipv6_udp[] = {
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x34, 0x29, 0x40, 0x20, 0x01, 0x04, 0xf8,
+    0x00, 0x04, 0x00, 0x07, 0x02, 0xe0, 0x81, 0xff, 0xfe, 0x52, 0xff, 0xff, 0x20, 0x01, 0x04, 0xf8, 0x00, 0x04, 0x00, 0x07, 0x02, 0xe0, 0x81, 0xff, 0xfe, 0x52,
+    0x9a, 0x6b, 0x60, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x11, 0x40, 0xde, 0xad, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xbe, 0xef,
+    0xca, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xba, 0xbe, 0x75, 0x30, 0x32, 0xc8, 0x00, 0x0c, 0x83, 0xd2, 0x58, 0x58,
+    0x58, 0x58};
+
 #ifdef __cplusplus
 }
 #endif